How to allow Caltsu in Google Workspace
Steps for Google Workspace admins to allow Caltsu in the Admin console, with the exact OAuth scopes it requests and what each is for.
4 min readGoogle Calendar
On this page6
This guide is for Google Workspace administrators. A user in your organization tried to connect their work calendar to Caltsu, and Google blocked the sign-in or said the app needs admin approval. Below is what Caltsu requests, why, and how to allow it.
Why you are seeing this
Workspace admins can control which third-party apps may use Google sign-in and access Google data. If your organization blocks unconfigured apps, or has marked Google Calendar as a restricted service, users cannot connect Caltsu until you allow it.
Google treats calendar scopes as sensitive, and your API control settings decide what happens to them. When Calendar is restricted, only apps you mark as trusted can access it.
Scopes Caltsu requests
Caltsu signs users in with OAuth. It never sees passwords and can reach only the calendars of the user who signed in.
| Scope | What Caltsu uses it for |
|---|---|
openid | Sign the user in with their Google account |
email | Read the user's email address to identify the account |
profile | Read the user's basic profile, such as their name |
calendar.readonly | List the user's calendars and read event times to know when they are busy |
calendar.events | Create, update and delete the blocks Caltsu adds |
The full scope URLs are:
https://www.googleapis.com/auth/calendar.readonlyhttps://www.googleapis.com/auth/calendar.events
Caltsu does not request Gmail, Drive, Contacts or directory scopes.
Allow Caltsu in the Admin console
- Sign in to the Google Admin console as a super admin or an admin with security privileges.
- Go to Security > Access and data control > API controls.
- Select Manage third-party app access.
- Find Caltsu in the list of accessed apps. It appears after a user in your organization has tried to connect. If it is not listed, select Configure new app and search for Caltsu.
- Choose who the setting applies to: your whole organization, or specific organizational units or groups.
- Set the access level:
- Trusted lets Caltsu request any scope, including restricted services. Choose this if Google Calendar is restricted in your organization.
- Specific Google data lets you allow access to Google Calendar only.
- Limited lets Caltsu access only services you have not restricted.
- Blocked stops every user from connecting Caltsu.
- Review and confirm.
Google can take a while to apply the change for all users. After that, users can go back to Caltsu and connect their account again. Menu names in the Admin console change from time to time, so the path may look slightly different for you.
Check the Google Calendar service setting
On the API controls page, select Manage Google services and find Google Calendar. If access is set to Restricted, only trusted apps and apps allowed for Calendar data can use calendar scopes. Leave it restricted if that fits your policy and trust Caltsu as described above.
Limit Caltsu to specific users
To allow Caltsu for only some people, apply the Trusted or Specific Google data setting to the organizational units or groups that need it, and leave the app blocked for everyone else.
What Caltsu writes to calendars
When a user sets up a sync rule, Caltsu adds blocks to their other calendars. Each block carries:
- The start and end time of the original event
- A title, "Busy" by default, which the user can change
- The description "Blocked time from" followed by the source calendar name
Blocks never include the original event's title, attendees, location, notes or meeting link. Caltsu stores event IDs and a change fingerprint derived from the event's title and times, so it can update the right block when an event changes. Removing a sync rule removes the blocks it created.
Caltsu's database is in Frankfurt, Germany. The company behind it is DataDux Oy in Helsinki.